Topic

Microsoft Active Directory Domain Services account hardening

Applicable to

all

History

Sep 2024

Service accounts configured with an SPN do not have DCSync permissions.

A new control was added recommending that service accounts configured with an SPN not have DCSync permissions.